Gemini's image filter said no, but its download link still handed over the file

What the researcher found

As Escudo Digital reported, a flaw in how Google Gemini handles images let users download pictures that its own safety filters had already blocked. The affected material included depictions of Mickey Mouse, which raise copyright concerns, and unauthorized edits of photos.

The discovery came from Jason Kao, a researcher at the cybersecurity firm Fog Security. He noticed that the chat window and Google's internal system for delivering files did not agree with each other. Fog Security summed it up this way: "the model said no, but the download link said yes."

Two links, one rule

On screen, Gemini behaved as it should. It showed a polite refusal and did not display the rejected image in the conversation.

Behind the scenes, though, the platform created two separate web addresses for each image request. One powered the preview inside the chat. The other powered the full-size download. The block applied to the preview, but it did not always apply to the download link, which was its own address on Google's servers.

That download link could lead to the rejected image, or to earlier drafts made while the image was being created. In plain terms, the lock was on the front door, and a side door stayed open.

Why this was not a typical jailbreak

Many stories about AI safety failures involve a jailbreak, where a user writes a clever prompt to talk the model into breaking its rules. This case was different. According to the source, nobody had to trick the system or manipulate its instructions.

The weakness was in the infrastructure that carries files to the user, not in the model's judgment. That is the more important lesson. A model can be trained to refuse correctly and still fail to protect anyone if the plumbing around it does not enforce the refusal too.

Fog Security made the same point in conceptual terms. It argued that a refusal to generate an image is not, by itself, a real security control. A refusal is a message shown to the user, and a control has to actually stop the file from leaving.

Fixed quietly, and not called a flaw

The firm reported the problem to Google last June. According to the source, Google played down the report and did not treat it as an exploitable security flaw. Checks made in late October showed the behavior had been fixed.

Google credited the change to routine maintenance and closed the case without formally labeling it a vulnerability. That matters because a formal label usually triggers public records and tracking that help outsiders see what went wrong.

The source leaves several questions unanswered. It does not say how many people could have used the gap, whether anyone actually did, or how many images got through. It also does not give a Google statement beyond the handling described above.

What to take from it

Many people assume that if an AI tool has a built-in filter, anything it hands over is safe to use. This report is a reminder that a filter is a safeguard, not a guarantee, and that it can have gaps in places the user never sees.

If you use Gemini or any image generator for marketing visuals, social posts, class materials or client work, the practical habit is simple:

• Have a person look at every generated image before it goes out.
• Check for recognizable characters, logos or real people's likenesses.
• Keep a record of what you approved and when.

The responsibility for what gets published falls on the publisher, not on the tool that made the image.